WO2020190165A1

WO2020190165A1 - Method and system for identifying a user from cursor movement trajectory

Info

Publication number: WO2020190165A1
Application number: PCT/RU2019/000169
Authority: WO
Inventors: Павел Владимирович СЛИПЕНЧУК
Original assignee: Общество С Ограниченной Ответственностью "Группа Айби"
Priority date: 2019-03-19
Filing date: 2019-03-19
Publication date: 2020-09-24

Abstract

The present technical solution relates to the field of computer engineering. The technical result is to automatically identify a user from cursory movement trajectory. A method consists in executing steps in which, using a computer device, registration data of a user in a system are recorded, a corresponding user identifier is assigned, and, during the work of the identified user, a cursor movement trajectory is analyzed, wherein for each position of the mouse cursor the vertical and horizontal coordinates of the mouse cursor and the time mark are recorded, the sequence of coordinates is saved and the recorded sequence is analyzed, a list of fragments of the cursor trajectory is generated, cursor trajectory fragments are computed for each list, computed attributes are saved in a data base, at least one classifier is trained to identify said user from the mouse cursor movement trajectory, and the trained classifier is used for subsequent confirmation of the user's identity.

Description

METHOD AND SYSTEM FOR USER IDENTIFICATION BY TRAJECTORY

CURSOR MOVEMENT

FIELD OF TECHNOLOGY

The present technical solution relates to the field of computing, in particular, to a method and system for identifying a user along the trajectory of a computer mouse cursor.

TECHNOLOGY LEVEL

The task of protecting information from unauthorized access is becoming more and more urgent. The most reliable results are obtained using biometric authentication methods.

A new direction of identification and confirmation of the user's identity is tracking his behavioral features, which are manifested in the nature of work with various manipulators: a light pen, a mouse manipulator, a keyboard, etc. The term informational handwriting of the user (hereinafter referred to as API) reflects the user's work style with input devices. As a result of tracking and analyzing the API by means of modern information technologies, a unique image for each user can be formed, which, in turn, can be further used as an additional, in relation to known means and methods, a means of user identification when entering the system, and also a means of remote assessment of his emotional and physiological state.

A significant number of methods for identifying a user by analyzing the movement of a computer mouse cursor are known from the prior art; in part, such solutions are described in applications: US2011113388A1, publ. 05/12/2011; US2007255818A1, publ. 11/01/2007; US9526006B2, publ. 12/20/2016; US9521551B2, publ. 12/13/2016;

US9275337B2, publ. 03/01/2016.

In addition, in the current state of the art, solutions are known that locally resolve issues of verifying the identity of a user during interaction with a computer manipulator, they are disclosed in the following documents: article "Mouse Movement Behavioral Biometric Systems" by Nazirah Abd. Hamid et al, publ. 2011; article "Advanced mouse-tracking analytic techniques for enhancing psychological science" by Eric Hehman et al, publ. 2014; article "Biometric Authentication Using Mouse Gesture Dynamics" by Bassam Sayed et al, publ. 2013.

However, the solutions known from the prior art for identifying users along the path of the cursor movement have limited functionality: firstly, they have a pronounced learning phase, during which the user is asked to perform predetermined mouse movements. For example, draw a geometric shape with the cursor, repeat the indicated mouse gestures, drag and drop an object into a given area, etc. In particular, it is important here that the training of systems implementing methods known from the prior art is usually carried out on a deterministic, a priori known set of cursor paths.

Secondly, the analysis of cursor movement is performed along the entire trajectory of its movement; the entire set of cursor movements from the beginning to the end of each mentioned exercise is analyzed, converted into a set of features, and used to train the decision rule.

Third, in all of the above methods, the analysis is performed without taking into account the semantic context of the environment in which the user works. In other words, the movement of the cursor is analyzed, assuming the entire area of the user-accessible interface to carry the same meaning and equally significant.

SUMMARY OF THE INVENTION

The technical problem to be solved by the claimed technical solution is the creation of a computer-implemented method and system for user identification along the path of the cursor movement, which are characterized in independent claims. Additional embodiments of the present invention are presented in the dependent claims.

The technical result consists in automatic user identification along the path of the cursor movement.

In a preferred embodiment, a computer-implemented method for identifying a user along the path of a cursor movement is claimed, which consists in performing the steps at which, using a computing device:

- register the user's credentials in the system;

- assign a user ID corresponding to the credentials; - throughout the entire session of the identified user, the trajectory of the mouse cursor is analyzed, for which:

• for each position of the mouse cursor, the vertical and horizontal coordinates of the mouse cursor and the time stamp when these coordinates were fixed are fixed;

• save the sequence of the mouse cursor coordinates and their corresponding time stamps;

• analyze the recorded sequence to search for points of dividing the trajectory of the mouse cursor movement into fragments;

• form a list of fragments of the cursor trajectory during a session of this user;

- for each fragment of the cursor trajectory a set of predetermined features is calculated and the calculated features are stored in the database,

- accumulate a predetermined number of sessions of this user, and on the basis of the characteristics calculated during these sessions, train at least one classifier to identify this user along the trajectory of the mouse cursor;

- the trained at least one classifier is used to subsequently confirm the identity of the user, during the sessions of which at least one classifier was trained.

In a particular version, the points at which the cursor was motionless for more than a predetermined time are considered to be the points of dividing the trajectory of the mouse cursor into fragments.

In another particular version, the graphical interface in which the user sessions take place is pre-divided into windows, and the windows are divided into zones.

In another particular embodiment, points of dividing the trajectory of the mouse cursor into fragments are additionally considered the points where the mouse cursor moves the boundaries between the zones of each window, as well as the moments of changing the windows of the graphical interface on the user's display.

In another particular embodiment, each zone of each window can be assigned a coefficient associated with this zone. In another particular version, the classifier is trained using the machine learning method.

In another particular version, the classifier can be implemented as a graph probabilistic model or as an SVM classifier.

In another particular version, a separate classifier is trained for each window. In another particular version, a separate classifier is trained for each zone.

In another particular version, the solution of each classifier is multiplied by a constant value corresponding to the coefficient of the zone for which this classifier is trained.

In another particular embodiment, the decision about the user's identity or non-identity is the sum of the decisions of all classifiers.

The claimed solution is also implemented through the user identification system along the path of the cursor movement, containing:

- computer mouse;

- block of registration of user credentials in the system; - system clock, made with the ability to fix time

- a unit for registering the position of the mouse cursor, made with the ability to fix the vertical and horizontal coordinates of the mouse cursor;

- long-term memory, made with the ability to store the database;

- a computing device capable of performing the above-described method.

In one of the possible implementation options, the claimed solution is an integral part of the remote banking system.

In another possible implementation option, the claimed solution is an integral part of the website, implying user authorization. In another possible implementation, the user identification system is an integral part of a multiplayer computer game, implying user authorization. In another possible implementation, the user identification system is an integral part of the software and hardware complex for collaboration, implying user authorization.

DESCRIPTION OF DRAWINGS

The implementation of the invention will be described in the following in accordance with the accompanying drawings, which are presented to clarify the essence of the invention and in no way limit the scope of the invention. The following drawings are attached to the application:

FIG. 1 illustrates a computer-implemented method for identifying a user along a path of a cursor movement;

FIG. 2 illustrates the various coordinates that can be obtained by determining the position of the mouse cursor;

FIG. 3 illustrates a graphical user interface window that is divided into zones;

FIG. 4 illustrates an example of describing various areas of a graphical user interface window;

FIG. 5 illustrates an example of the trajectory of the mouse cursor in one of the windows of the graphical user interface;

FIG. 6 illustrates an example of dividing the path of movement of the mouse cursor into fragments;

FIG. 7 illustrates an algorithm for finding points dividing the trajectory of the mouse cursor into fragments;

FIG. 8 illustrates an example of a general arrangement of a computing device.

DETAILED DESCRIPTION OF THE INVENTION

In the following detailed description of an implementation of the invention, numerous implementation details are set forth to provide a thorough understanding of the present invention. However, it will be obvious to those skilled in the art how the present invention can be used, with or without these implementation details. In other instances, well-known techniques, procedures, and components have not been described in detail so as not to obscure the features of the present invention. In addition, it will be clear from the above description that the invention is not limited to the above implementation. Numerous possible modifications, changes, variations and substitutions, while retaining the spirit and form of the present invention, will be apparent to those skilled in the art.

The present invention is directed to providing a computer-implemented method and system for identifying a user along a path of a cursor movement.

The method will be described using the example of a remote banking service (RBS), however, this example is not limiting. In addition to the RBS system, which will be used to describe the method, the described method can also be implemented in computer online games, software for collaboration, programs or systems that support mouse gestures, etc.

In general, the described method can be implemented in any version of the authorized remote access service, which implies the presence of a computer mouse on the user's side, as well as elements of the user interface, interaction with which is possible through this manipulator.

As shown in FIG. 1, the claimed computer-implemented method for identifying a user along the path of the cursor movement (100) is implemented as follows:

At step (101), the user's credentials are pre-registered with the system. User credentials are username and password. It is an essential component of network security.

Next, in step (102), a user ID corresponding to the credentials is assigned.

At step (103), throughout the entire session of the identified user, the trajectory of the mouse cursor is analyzed, for which:

• analyze the recorded sequence to search for points of dividing the trajectory of the mouse cursor movement into fragments; • form a list of fragments of the cursor trajectory during the session of the given user.

At step (104), a set of predetermined features is calculated for each fragment of the cursor path, and the calculated features are stored in the database. At step (105), a predetermined number of sessions of this user is accumulated, and based on the features calculated during these sessions, at least one classifier is trained to identify this user along the path of the mouse cursor.

At step (106), the trained at least one classifier is used to subsequently confirm the identity of the user, during the sessions of which at least one classifier was trained.

In the future, we will assume that, regardless of the technical implementation of the described method, for each specific position of the mouse cursor, the following are available: coordinate X, coordinate Y and time t for which the data X and Y are fixed.

In some implementations, for example, if the program that implements the method is executed in a browser where a window with scroll bars is open, the coordinates pageX and / or pageY may additionally be available, which have the same meaning as X and Y, but not measured from the corner part of the window visible to the user, and from the corner of the active zone of this page. It is clear that always pageX> X and pageY> Y; when the current GUI window fits completely on the computer screen, pageX = X and pageY = Y.

All the listed coordinates have the dimension of the number of pixels.

FIG. 2 as an example, a window of the RB System 200 is shown, inside of which there is a part of the window 210 visible to the user, equipped with scroll bars, vertical 220 and horizontal 230. In the visible part of the window 210 there is a mouse cursor 240.

Thus, dataset D about the current position of the mouse cursor for any point k where the cursor is located looks like this:

D (k) = {Xk, pageXk, Yk, pageYk, t _k }; (1) where t _k is the current time value obtained, for example, from the system clock. In the claimed solution, the obtained data set (1) is saved for further analysis. In another possible embodiment of the claimed solution, the data set (1) can be analyzed directly in the course of the user's work, without prior saving.

In addition to data (1), to implement the described method, it is necessary to obtain a user identifier from the RB System. A user identifier is at least one combination of symbols that uniquely characterizes a specific user working with the RB System.

For example, it can be an agent id (internal client identifier used in the banking system). A case is possible when the identifier is a function of a set of information about the software and hardware configuration of a personal computer from which the RB system is accessed.

As a rule, the user ID is encrypted in one way or another on the bank's side; its decryption is not required for the implementation of the described method; it is also unimportant how it was generated. It is enough for this identifier to be unique and stably reproducible during each session of access to the RB System under a specific account.

It is also possible to implement the described method, in which the user identifier is generated by the system that implements the method, based on one or more identifiers of a similar purpose coming from the banking system.

Generation of such a unique identifier can be performed in any generally known way, for example, by hashing a character string obtained by concatenating identifiers obtained from the banking system.

In what follows, for simplicity, we will denote the user ID as USER (i), where a different value of i indicates different users.

In the declared solution, data (1) is received from the RB system in association with a specific USER (i), and user sessions are formed.

Within the framework of this description, the session S of a specific user USER (i) is the associated data sets (1) recorded for the entire time that this user is in the RB System: S (n) uSER (i) - {D (l) uSER (i), D (2) uSER (i), D (3) uSER (i),. ... ... D (N) uSER (i)}; (2) where N is the total number of points visited by the cursor, and each dataset D corresponds to (1). It is clear that the beginning of each session is the moment the user enters a valid login and password, as a result of which the RB System gets the opportunity to identify the visitor. The end of the session is the moment when the user closes the last of the RBS system windows, or clicks the “Logout” link.

In general, more than one window is available to the user working in the RB System. Therefore, in one of the possible implementations of the described solution, the identifier of the current window of the user interface can also be used. This is a certain combination of symbols that uniquely corresponds to the user interface window that is currently open by the user.

The window itself can be a page of an Internet site, and then the identifier can be, for example, a hash from the URL of this page or from its title (a sequence of characters placed under the <title> tag). In another case, the window can be an element of the program interface, and then the identifier can be a hash of the name of this interface element or its other designation used in the program.

For the purposes of implementing the described method, it is sufficient that this identifier is unique within the framework of a given RBS system and is stably reproducible with each successful act of accessing a specific interface window. In what follows, we will denote the identifier of the current window as PAGE (j), where a different value of j indicates different windows of the user interface.

The session described by expression (2) contains a set of data for all points on the screen that the cursor has visited during the activity of a particular user USER (i) in the RB System. However, in such systems with more than one window, the system implementing the described method conducts a separate analysis of the cursor behavior for each specific window.

Therefore, the data (1) arriving during each session of the user USER (i) is additionally grouped by PAGE (j) and analyzed separately for each specific window. This allows us to take into account the fact that different windows of the RB system in general case, they have a different visual structure, on them interface elements are located in different ways, which causes different trajectories of the mouse cursor.

In what follows, it is assumed that the actions described here refer to one PAGE (j) window from a plurality of RBS windows. In each of the other windows, the actions of the system that implements the described method are algorithmically identical, but independently of the actions in other windows.

In other words, the method takes into account the semantic context within each window, regardless of the context of other windows in the RBS system.

In order to implement the described method, each window of the RB system can be preliminarily divided into several zones at the stage of creating a system that implements the method, as shown by dashed lines in Fig. 3.

For example, referring to FIG. 3, in window 300 of the RBS system the following are highlighted:

1. The navigation area of the top menu 310, containing an area with a link 312 to the start page of the RBS system, an area 314 of additional links and an “exit area” 316 containing a link to log out.

2. Zone of the left menu 320, containing interface elements (graphic “buttons” or inscriptions) 322 ... 329 with links, for example, to various windows of the RB system for various banking operations available to a given user.

3. The zone of the current banking operation 330, containing text messages 331 and 339, field 332 to indicate the account from which the payment or transfer is made, field 334 to indicate the account to which the payment or transfer is made, field 336 to enter the code from SMS messages and a button 338 confirming the operation.

4. The area of advertising messages 340, containing an interactive advertising banner 342, under which is a link to a page, for example, an advertised action.

5. Zone of pop-up messages 350, which is used to issue contextual hints to the user of the RB System and does not contain active links.

Technically, the preliminary division of each RBS window into zones can be performed, for example, in the form of specifying the coordinates of points that are the corners of each zone, and saving the coordinate data as a set of zone templates Z _I .,. Z _M associated with a specific RBS window PAGE (j ). By way of example, in FIG. 4 shows how the area 320 of the window 300 previously shown in FIG. 3 are described by the coordinates of points A, B, C, D, and the zone 330 of the same window is described by the coordinates of points B, E, F, D. Any zones of any window of the RBS system can be described in a similar way.

Zone templates 320 and 330 can look like:

Z320 = {(XA, YA), (XB, YB), (XC, YC), (XD, YD)}; (Per)

Z ₃₃₀ = {(XB, YB), (XE, YE), (XF, YF), (XD, YD)}; (3b)

The coordinates of each point, for example, (XB, YB), can be expressed as an absolute value, for example, (450, 275), and have the dimension of the number of pixels located horizontally and vertically between this point and the upper left corner of the window.

Alternatively, the coordinates (Хв, YB) can be expressed as a relative dimensionless quantity, for example, (0.2, 0.15) and calculated for each specific user USER (i) taking into account the screen resolution he uses and, accordingly, the size of the RB system window on the screen of this user ...

At the stage of creating a system that implements the described method, each zone Z (m) of each window PAGE (j) of the RBS system can be assigned a “importance factor” Pz ₍ m) associated with this zone. This factor is a constant, integer or fractional, the value of which is selected in proportion to the priority of this zone, for example, according to the following principle: the larger the value of the constant, the higher the priority of the zone.

For example, the area 330 shown in FIG. 3 and 4, may have the highest importance coefficient Rzo from all zones of window 300, since it is directly associated with the operation of transferring funds from the user's account. The zone 320 associated with transitions to other accounts of a given user may have the next highest importance factor P320, and so on.

Finally, the zones 340 and 350, not associated with any transactions with the user's funds, may have the smallest coefficients P340, Pz50. In this way

Рзо> Рзо> Рзю> Р340> Р350; (4)

The numerical values of the coefficients specified at the stage of creating the system, as well as the information about the boundaries of the zones in each window, are associated by the system with each specific window and are constantly stored throughout all stages of the system with all users. The above coefficients characterize certain areas (zones) of the graphical user interface, therefore, when the system is working with any user, the values of these coefficients will be the same.

In those windows of the RBS system that do not have a pronounced attractiveness for intruders who have taken possession of someone else's credentials, for example, in the window for paying utility bills or in the window with information about the location and opening hours of bank branches, dividing the window into zones and assigning to zones “importance ”May not be executed.

Nevertheless, the system implementing the method receives and stores (or immediately analyzes, as described) the data D (k) corresponding to (1), and in such windows too.

FIG. 5 shows an example of the trajectory of the mouse cursor in one of the RBS system windows.

This trajectory is essentially an array of data of the form (2) stored in the operative or permanent memory of a computer system that implements the described method, however, for ease of perception, it is shown in the figure as a continuous line. It is assumed that each of the points that make up this line is described by a dataset (1).

The start of the path corresponding to the position of the mouse cursor when this window was opened is in this example just above the text message 331.

As can be seen in FIG. 5, after opening the window, the user first became interested in the interactive banner 342 and moved the cursor over it for a while. Then he proceeded to perform the transfer and placed the cursor in the field for specifying the payer's account 332, then in the field for specifying the beneficiary's account 334. After some time, the user moved the input focus to window 336 for the confirmation code from the SMS and a little later moved the mouse cursor to the button confirmation of payment 338.

It should be noted that the complete ensemble of user actions, in addition to moving the cursor, of course, can also include pressing (“clicks”) of the left and right mouse buttons, rotating the mouse scroll wheel and other actions.

Signals corresponding to these events are generated in the computer system or browser where the user is working. However, within the framework of the described method signals about such events are not used, therefore, in this description, neither these events themselves, nor the signals corresponding to them are considered.

Analysis of data (2) on the movement of the mouse cursor begins with building a list of decomposition points, i.e. the list of points dividing the full path of the cursor in this window of the RB system into fragments.

FIG. 6 shows an example of such a decomposition in relation to the trajectory shown earlier in FIG. 5. Zones 330 and 340 in FIG. 6 belong to the previously described window of the RB System 300. The elements of the user interface 331 ... 342 in FIG. 6 for ease of perception are not shown.

The first fragment of the path, the beginning of which coincides with the beginning of the path of movement of the mouse cursor 610, ends at the point where the cursor intersects 615 the boundary of the zones 330 and 340, described earlier in connection with FIG. 3.

From point 615, the next fragment of the trajectory begins, which ends at point 620, where the mouse cursor stopped and remained motionless for some time while the user viewed the response of the interactive banner to placing the cursor over it.

The next section of the path begins at point 620 and ends at point 630, which is also defined as the point where the cursor stopped. The fragment of the trajectory between points 630 and 640 is similarly selected.

Then the cursor, moving from point 640, crosses the border of zones 330 and 340 at point 645, and this defines a fragment of the trajectory lying between points 640 and 645. The next fragment is between points 645 and 650. Points 650 ... 670, defining further fragments the paths of the mouse cursor are also the cursor stopping points.

Finally, point 680, which ends the last fragment, between 670 and 680, is the last in the array of data associated with this window, because after the user pressed the previously shown transaction confirmation button 338 located at this point, the RBS system closed this window 300 (and opened the following, but in this case it is unimportant, since the actions performed by the system that implements the described method in a new window will be similar to the actions described for this window). The detection of decomposition points, similar to points 620, 630, 640, etc., is performed by searching for points at which the cursor was motionless for some time deltaT, and comparing this time deltaT with a predetermined empirically selected parameter dTmax.

For example, the value of the parameter dTmax can be chosen equal to 0.3 seconds. In the event that deltaT turns out to be greater than dTmax, this point of cursor stopping is considered a point separating the fragments of the motion path.

Points like 615 and 645 are detected by comparing the coordinates of each point with the coordinates of the zone boundaries that were obtained at the stage of creating the system and are stored, for example, in the form (3a), (3b), as parameters associated with a specific window of the RBS system.

FIG. 7 illustrates an example of an algorithm 700 that can be used to find points that chunks the path of a mouse cursor. At start step 710, the variables i and deltaT are initialized with the values i = l and deltaT = 0. Step 720 obtains two adjacent datasets D (i) and D (i + 1); each of these datasets has the form (1).

At step 730, it is determined whether the cursor remained stationary relative to the window in the time interval between t (i) and t (i + l), and if so, then at step 750 deltaT is increased by an amount corresponding to the difference between t (i) and t (i + l), increment i is performed at step 780, check at step 790 whether the end of the session (2) has been reached, that is, whether the data set D (i) is the last data set recorded during the user's work in this RB System window , and return to step 720. Checking in relation to pageX, pageY allows to take into account the cases when the user "scrolled" the RBS window larger than the screen using the keyboard or the mouse wheel (the X and Y coordinates will not change, but pageX and \ or pageY, depending on the direction of scrolling).

If at step 730 it was determined that the cursor has moved, then at step 740 it is checked whether the point X (i + 1), Y (i + 1), to which the cursor moved, belongs to the set of points describing the boundaries of the zones, as shown above in relation to FIG. 4.

If this is the case, then the identifier of the found intersection point of the border of zones (the identifier can, for example, be represented by a serial number in a cycle, that is, i + 1) is entered into a general, within this PAGE® window, a list of decomposition points, then return to the general loop in steps 780, 790.

If no border crossing is detected at step 740, then at step 760 the accumulated deltaT value is checked against a predetermined parameter dTmax. If deltaT exceeds the value of the dTmax parameter, this indicates that a point has been found for a sufficiently long cursor stop, and the corresponding identifier of this point i + 1 is entered into the list of decomposition points, and then returns to the general loop in steps 780, 790.

The loop is exited when the end of this session is reached at step 790 (2).

Thus, as a result of running algorithm 700 on the path shown in FIG. 5 and 6, a complete list of decomposition points will be obtained, namely in terms of FIG. 6:

Ld = {610, 615, 620, 630, 640, 645, 650, 660, 670, 680}; (five)

Using the list of decomposition points, a list and coordinates are obtained, that is, datasets Di corresponding to (1), for the start and end points of each of the fragments of the cursor movement path Cn:

Lc = {Ci (D610, D615); C2 (D615, D _62O ); C ₃ (D620, D63O); C4 (D630, DMO); CS (D640, D645); Sat (Ob45, ϋό5q); C7 (D650, D660); C8 (D660, ϋd7q); C9 (D670, D68O)}; (6a)

In an alternative embodiment, the lists of fragments are made by grouping fragments according to their belonging to different zones of the RB System window.

In this variant, two lists will be generated, one for zone 330, the other for zone 340:

Lc330 = {Cl (D610, D615); Sat (Ob45, D65O); C7 (D650, D660); C8 (D660, D ₆₇ O); C9 (D670, D68O)};

LC340 = {Cr (Ob15, D ₆ 20); C ₃ (D ₆ 20, D63O); C4 (D630, D _64O ); CS (D640, D645)}; (6b)

The system that implements this method performs the above steps and stores the received data, accumulating the number of sessions specified at the stage of designing the system. Upon reaching this predetermined number, the system proceeds to training at least one classifier.

For each user, at least one decision rule (classifier) is trained according to the compiled lists of fragments of the mouse cursor movement path (6a) or (6b). In the event that this PAGE® window of the RB System was previously divided into zones, which were assigned different “coefficients importance ”(4), for each of the zones its own classifier can be trained. Also, the solutions of these classifiers can be additionally scaled in proportion to the “importance factors” of the corresponding zones.

Due to this scaling, atypical user behavior in potentially attractive areas of “high-risk” windows of the RBS system, for example, such as area 330 in FIG. 3, is more likely to lead to the issuance of a warning signal by the system, rather than atypical user behavior in the RBS system windows that are not related to payments and transfers, for example, such as the neighboring zone 340 of the same window shown in Fig. 3.

The technical implementation of each classifier can be any generally known; it can be implemented, for example, as a graph probabilistic model (Random Forest) or as an SVM classifier.

To train the classifiers, features are preliminarily extracted from each of the lists of fragments of the cursor movement trajectory. Since the lists of trajectory fragments contain datasets of the form (1), each of which contains the coordinates of the point X, Y, and the time t, when these coordinates were fixed, then using these data it is not difficult in any generally known way to calculate any parameters that have the meaning of distance , direction, time, speed (movement of the mouse cursor), as well as their derivatives.

Below, as a non-limiting example, there is a list of features (7.1) ... (7.9) that can be calculated to train classifiers according to the described method. The list is not complete; the total number of features extracted from the named data can be much larger, up to several hundred. In addition, the parameters listed below are for illustration purposes only; the computation of any of them is optional for the implementation of the described method.

As a non-limiting example, the following features can be listed, which are calculated for each fragment of the mouse cursor movement path from (6a) or (6b) described by a data set of the form Ck = {D (l), D (2), D (3),. .. D (N)}.

It is assumed that each dataset D, from 1st to N-ro, corresponds to (1):

• total time of passing the cursor from the beginning to the end of the given fragment:

T - ΪN - ti; (7.1) • length of the working path S, i.e. the distance expressed in pixels between the beginning and the end of this fragment of the trajectory;

• the linear length of the trajectory of the fragment S, i.e. the sum of the distances between every two adjacent points;

average speed of movement of the mouse cursor V;

• mean square velocity of movement of the mouse cursor l / ^;

• speed of movement of the mouse cursor on the first 5%, 10%, 20% of the length of this fragment of the trajectory, _{0 05} , V _{Q 1} , V _{Q 2} : where) = [0.05 * N] (7.6)

_ (Yj ₊₁ —Yj) ² + (X _{j + 1} —Xj) ²

^ oi ⁼ : + i: tj; where j = [0,1 * N] (7.7)

tj

N (.Yj + i-Yj) ² HXj + i-Xj) ²

V _t 0.2; where j = [0.2 * N] (7.8)

tj + i tj

• the maximum speed V _{max of the} movement of the mouse cursor during this fragment of the trajectory:

The calculation of these, as well as other parameters of the movement of the mouse cursor can be performed in any generally known manner. Using the calculated parameters as features, the classifier or classifiers are trained.

Below is an example of user identity control.

As mentioned above, in the claimed solution, data (1) received from the RBS system and associated with a specific user USER (i) and the current PAGE © window, and form user sessions (2), analyzing the data separately for each specific window.

After successful authorization, the user is identified based on the user id, then the classifier or classifiers trained earlier in the sessions of this user for this particular window or for this zone of a particular window are selected and launched. At the input of the classifier or classifiers, the features extracted from the fragments of the trajectory of the mouse cursor are fed. Features are parameters, for example, parameters (7.1 ... 7.9), calculated for the current session in the same way as they were calculated before training the classifier or classifiers.

The decision (work result) of each classifier is a numerical estimate of the probability that the “cursor handwriting” of the person who has just entered the login and password belongs to the very user at whose sessions the classifier or classifiers were trained.

In the embodiment, where some windows of the RBS system contain zones that are assigned “importance factors” (4), the decisions of the classifiers trained on these zones can be additionally scaled taking into account the mentioned factors.

Scaling can mean, for example, increasing or decreasing the numerical response of the classifier to a constant corresponding to the “importance factor”. In another implementation, the numerical response of the classifier can be multiplied by such a constant.

The solutions of each classifier or group of classifiers associated with a given USER (i) are combined into a general solution of the system that implements this method. In one possible implementation, this union can be a summation or multiplication of the numerical responses of all classifiers associated with a given user. The solution of the system, which also has the meaning of a numerical assessment of the probability, goes to the anti-fraud system of the bank, where it can be used to generate alarm notifications that have the meaning of warning about atypical behavior of a particular user, or other signals of a similar purpose.

For new users, as well as for users who have recently changed their password for some reason, at the same time, actions can be performed to obtain new sessions and train new classifiers. Such actions were described above in the stated decision.

In an alternative embodiment of the method, which implies working as part of an access control system installed and executed on a service personal computer, the session left by the user after entering the login and password is transmitted to the input of a plurality of classifiers, each of which is pre-trained in the “cursor handwriting” of one of the set employees of this enterprise or division.

If none of the classifiers “recognizes” the person who entered the credentials, and also if one of the classifiers “recognizes” the person who does not have the right to access this computer, the subsystem that implements the described method generates an alarm signal, transferred to authorized persons, for example, employees of the information security department.

FIG. 8 below will be presented a general diagram of a computer device (800) that provides data processing necessary to implement the claimed solution.

In general, the device (800) contains components such as: one or more processors (801), at least one memory (802), data storage means (803), input / output interfaces (804), I / O means ( 805), networking tools (806).

The processor (801) of the device performs the basic computational operations necessary for the operation of the device (800) or the functionality of one or more of its components. The processor (801) executes the necessary machine-readable instructions contained in the main memory (802).

Memory (802), as a rule, is made in the form of RAM and contains the necessary program logic that provides the required functionality. The data storage medium (803) can be performed in the form of HDD, SSD disks, raid array, network storage, flash memory, optical storage devices (CD, DVD, MD, Blue-Ray disks), etc. The means (803) allows performing long-term storage of various types of information, for example, the aforementioned files with user data sets, a database containing records of time intervals measured for each user, user identifiers, etc.

Interfaces (804) are standard means for connecting and working with a computer device, for example, USB, RS232, RJ45, LPT, COM, HDMI, PS / 2, Lightning, FireWire, etc.

The choice of interfaces (804) depends on the specific implementation of the device (800), which can be a personal computer, mainframe, server cluster, thin client, smartphone, laptop, be part of a bank terminal, ATM, etc.

A mouse should be used as I / O data (805) in any embodiment of a system implementing the described method. The hardware implementation of the mouse can be any known. Connecting the mouse to the computer can be either wired, in which the mouse connecting cable is connected to the PS / 2 or USB port located on the system unit of the desktop computer, or wireless, in which the mouse exchanges data via a wireless link, for example, a radio channel. with a base station, which, in turn, is directly connected to the system unit, for example, to one of the USB ports. In addition to a mouse, I / O data can also include: joystick, display (touch screen), projector, touchpad, keyboard, trackball, light pen, speakers, microphone, etc.

Networking means (806) are selected from a device that provides network reception and transmission of data, for example, an Ethernet card, WLAN / Wi-Fi module, Bluetooth module, BLE module, NFC module, IrDa, RFID module, GSM modem, etc. The means (805) provide the organization of data exchange via a wired or wireless data transmission channel, for example, WAN, PAN, LAN, Intranet, Internet, WLAN, WMAN or GSM.

The components of the device (800) are interfaced through a common data bus (810).

In this application materials, a preferred disclosure of an implementation of the claimed technical solution has been provided, which should not be used as limiting other, particular embodiments of its implementation, which do not go beyond the scope of the requested scope of legal protection and are obvious to specialists in the relevant field of technology.

Claims

Claim

1. A method for identifying a user along the path of the cursor movement, which consists in performing the stages at which, using a computing device:

- register the user's credentials in the system;

- assign a user identifier corresponding to the credentials;

- throughout the entire session of the identified user, the trajectory of the mouse cursor is analyzed, for which:

• for each position of the mouse cursor, the vertical and

the horizontal coordinates of the mouse cursor and the timestamp when these coordinates were fixed;

• form a list of fragments of the cursor trajectory during the session of the given user.

2. The method according to claim 1, characterized in that the points where the cursor was motionless for more than a predetermined time are considered to be the points of dividing the trajectory of the mouse cursor into fragments.

3. The method according to claim 1, characterized in that the graphical interface in which the user's sessions take place is pre-divided into windows, and the windows are divided into zones.

4. The method according to claim 3, characterized in that the points of dividing the trajectory of the mouse cursor into fragments are additionally considered the points where the mouse cursor moves the boundaries between the zones of each window, as well as the moments of changing the windows of the graphical interface on the user's display.

5. The method according to claim 4, characterized in that each zone of each window can be assigned a coefficient associated with this zone.

6. The method according to claim 1, characterized by the fact that the classifier is trained by the machine learning method.

7. The method according to claim 6, characterized in that the classifier can be implemented as a graph probabilistic model or as an SVM classifier.

8. The method according to claim 3, characterized in that a separate classifier is trained for each window.

9. The method according to claim 3, characterized in that a separate classifier is trained for each zone.

10. The method according to PP. 6, 9, characterized in that the solution of each classifier is multiplied by a constant value corresponding to the coefficient of the zone for which the given classifier is trained.

11. The method according to PP. 6, 9, 10, characterized in that the decision on the identity or non-identity of the user is the sum of the decisions of all classifiers.

12. User identification system along the path of the cursor movement, containing:

- computer mouse; - block of registration of user credentials in the system;

- system clock, made with the ability to fix time

- long-term memory, made with the ability to store the database; - a computing device capable of performing the method according to any one of claims. 1-11.

13. The system according to claim 12, characterized in that the user identification system by keyboard handwriting is an integral part of the remote system

banking services.

14. The system of claim. 12, characterized in that the user identification system is an integral part of the website, implying user authorization.

14. The system according to claim 12, characterized in that the user identification system is an integral part of a multiplayer computer game,

implying user authorization.

15. The system according to claim 12, characterized in that the user identification system is an integral part of a software and hardware complex for collaboration, implying user authorization.